Uploaded image for project: 'C# Driver'
  1. C# Driver
  2. CSHARP-2163

Make PasswordEvidence implementation FIPS compliant

    XMLWordPrintableJSON

Details

    • Icon: Improvement Improvement
    • Resolution: Fixed
    • Icon: Major - P3 Major - P3
    • 2.6.0
    • 2.5
    • Security
    • None

    Description

      The implementation of PasswordEvidence uses SHA256Managed and SHA256Managed is not FIPS compliant.

      In fact, PasswordEvidence doesn't need to use SHA256 at all. It is only used as an optimization for the Equals method, to avoid having to decrypt the SecureString to compare two passwords.

      Equals should be implemented in such a way that two PasswordEvidence instances can be compared without using a non-FIPS compliant method.

      Attachments

        Activity

          People

            robert@mongodb.com Robert Stam
            robert@mongodb.com Robert Stam
            Votes:
            1 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: